News for hackers. Stuff that matters.
Re:European Payments Initiative (EPI) by bobthepanda on Thursday September 02, 2021 @11:13AM (#28393049)
What I’m curious about is, how does credit card fraud get handled in the EU?

At least in the US that kind of fraud is the bank’s problem, which is why I prefer using credit over debit.

Re:European Payments Initiative (EPI) by pimterry on Thursday September 02, 2021 @11:24AM (#28393209)
It's reduced as a problem I think, and in general credit cards are certainly far less popular than in the US.

I suspect fraud is less of an issue because accepting signatures for card purchases hasn't been common for at least a decade (you need the PIN for all spending above the contactless limit - about 30 euros in most countries) and PSD2 (mandatory for transactions since 2020) requires 2FA authentication for most online transactions too. See https://en.wikipedia.org/wiki/Strong_customer_authentication.

That means copying or stealing a debit card, or capturing entered online card details by themselves won't get you very far in the EU, which removes a lot of classic fraud. In the remaining cases though, I have no idea!

Re:European Payments Initiative (EPI) by larkost on Thursday September 02, 2021 @12:40PM (#28394223)
My impression was that because of the PIN used it was a lot riskier for the consumer with European cards: the credit card companies essentially said "the PIN was correct, so it could not have been fraud" so the default assumption was no fraud.

In the U.S. the system favors the consumer, so the merchant has to actively prove that it was not fraud (by default, this is definitely not blindly applied).

The signature part is one part of this, but the U.S. actually has laws in place to push this, and that largely has driven the non-PIN policy in the U.S. (since most of the anti-fraud pressure is on other parts of the system).

Re:European Payments Initiative (EPI) by jmkerr on Thursday September 02, 2021 @02:24PM (#28395530)
The customer still pays for fraud, one way or the other. So why not aim to prevent fraud in the first place by using a simple and effective second factor to mere possession of the card?
Re:European Payments Initiative (EPI) by argomo on Thursday September 02, 2021 @07:47PM (#28398792)
(1) Most people would rather pay the cost of fraud averaged across all accounts than suffer the risk of unlimited fraud against their own account.

(2) Putting the risk on credit card companies highly incentives them to fight fraud. This is ideal because they make the money and they are best positioned to fight it.

(3) Your premise is false to begin with. Higher fraud, like taxes, is payed for by some combination of the customers, the employees, and the owners (though actually it's more complicated than that due to contractual agreements: I believe merchants bear the penalty so we get recursive).

Even when the customer pays exclusively, there's a propagation delay that hits somebody else's wallet in the interim. (E.g., merchants don't raise prices immediately everytime fraud/taxes/wages increase.) It's a mistake to think of this as a mere transitory effect rather than a structural advantage that favors the consumer.

Re:European Payments Initiative (EPI) by jmkerr on Monday September 06, 2021 @04:27PM (#28437685)
PINs are safer, and less fraud is better. At the end of the day, shifting blame and liability is not going to change anything.

However, using security factors like secrets or updating the withdrawal limit is possibly inconvenient, that's why some people rather not use them and companies are incentivised to just recover the relatively minor losses to fraud in fees.

I guess it comes down to the fact that in some countries people are used to having about five different cards, and in others it's close to one.

((1) is both disingenuous (ignoring sensible withdrawal limits) and mathematically wrong (unlimited fraud spread evenly over all accounts is still unlimited fraud against every account). I guess people would pay more to avoid surprises, but they'd like it even more if there was less fraud.)

(3) The point was more that someone will have to pay for the fraud that is happening. Deriving a structural advantage from not using secrets is far fetched.

Re:European Payments Initiative (EPI) by afiori on Saturday September 04, 2021 @09:49AM (#28415062)
Are you arguing in favor or against PINs for in-store purchases? I interpret the first point as in-favor, but I suspect you meant it as against...
Re:European Payments Initiative (EPI) by 8ytecoder on Thursday September 02, 2021 @01:12PM (#28394651)
Yeah the PIN merely shifts the responsibility while adding a small additional protection. This model also adds a lot more friction online - you need to enter the pin again and it’s usually different from the offline pin. Overall, my parents’ generation simply can’t deal with all of this.
Re:European Payments Initiative (EPI) by m12k on Thursday September 02, 2021 @11:25AM (#28393228)
I think the solution is their requirement of 2FA for credit card payments[1]. Basically instead of this massive, expensive system to deal with fraud when it happens, and everyone paying banks to sometimes eat the cost of that, make it not happen in the first place. Not sure how successful it is, but it seems like the right idea.

[1] https://en.wikipedia.org/wiki/Strong_customer_authentication

Re:European Payments Initiative (EPI) by seppel on Thursday September 02, 2021 @12:06PM (#28393792)
For people like me "make it not happen in the first place" means online payments using credit card are no longer happening.
Re:European Payments Initiative (EPI) by floitsch on Thursday September 02, 2021 @01:18PM (#28394734)
Credit card payments in Europe now have to have 2-factor authentication.

This makes fraud much harder, while still allowing online payments with credit cards.

It is probably also helping smaller shops, as even Amazon customers now need to do something when they buy there.

Re:European Payments Initiative (EPI) by afiori on Saturday September 04, 2021 @09:52AM (#28415090)
> Credit card payments in Europe now have to have 2-factor authentication.

> This makes fraud much harder, while still allowing online payments with credit cards.

As an European I can confirm,

> It is probably also helping smaller shops, as even Amazon customers now need to do something when they buy there.

Nope, sadly. Amazon apparently can magically skip the 2FA most/all times.

My guess is that amazon has deals with banks to streamline the process, but I don't really know

Re:European Payments Initiative (EPI) by m12k on Friday September 03, 2021 @04:59AM (#28401912)
Could you elaborate? Did SCA somehow drive you to stop accepting credit card payments? Are you using a payment provider that doesn't offer support for 2FA?
Re:European Payments Initiative (EPI) by Pasorrijer on Thursday September 02, 2021 @11:34AM (#28393351)
As a Canadian, the only time I've had a credit card stolen is in the US. Not saying credit card doesn't happen in Canada, it does, but it's definitely a much, much bigger problem in the US. Almost like the banking system isn't adopting measures such as chip cards to combat theft fast enough.
Re:European Payments Initiative (EPI) by treve on Thursday September 02, 2021 @11:41AM (#28393469)
USA banking is usually a few years behind Canada, and 10 years behind Europe when it comes to adopting new technology.

In Europe the last time I saw a cheque was in the early 90's, and they are still used in Canada for things like rent.

I also remember traveling to the states in 2016 with my tap-enabled credit card, blowing people's minds in shops. All their equipment was ready for tap, but no US cards had it yet.

It also surprised me that things like Venmo have a reason to exist! I don't think many Americans know how bad they have it terms of banking tech.

Re:European Payments Initiative (EPI) by nraynaud on Thursday September 02, 2021 @12:12PM (#28393860)
In France I had to use a cheque for a weird tax reason (can't pay late with a credit card), and also when I bought a house, I had to refund the stuff to the seller by cheque during the signature ceremony.
Re:European Payments Initiative (EPI) by Bayart on Thursday September 02, 2021 @01:46PM (#28395089)
>In Europe the last time I saw a cheque was in the early 90's, and they are still used in Canada for things like rent.

It's still a thing in France, mostly because you can control the moment it's cashed in, it can be used as collateral for rent and so on, and because there's a tradition of paper documentation cheques play into.

But people of my generation rarely bother to get a cheque book at all, bank transfers are just fine.

Re:European Payments Initiative (EPI) by adventured on Thursday September 02, 2021 @12:09PM (#28393828)
I never cease to be amused by the wild exaggerations of foreigners.

How bad we have it. Comeon, just stop it.

So five years ago, you still had to enter a pin / swipe, you couldn't just tap. We've got it so bad. So bad! It's the dark ages here, circa five years ago.

> my tap-enabled credit card, blowing people's minds in shops

Yeah right. The iPhone had been around for nearly a decade, but oh wow tapping credit cards to blow minds.

> It also surprised me that things like Venmo have a reason to exist!

Crazy stuff! But like you said, we've got it so bad. An easy to use software service exists to transfer funds, incredible. The suffering. I feel dread just writing this comment and thinking about it.

Re:European Payments Initiative (EPI) by treve on Thursday September 02, 2021 @04:08PM (#28396731)
I'm not saying it's the end of the world, you're just way behind. I lived in USA, Canada and several European countries so it's first-hand experience, not an exaggeration,

I just listed some examples, but the frustration was real. Individually all minor inconveniences, but when you are used to a better system it's frustrating.

Top 3 real frustrations are the difficulty of international wires, the frequency I have to visit a branch and how weirdly hard it was in SF to split bills (the last may have changed since 2018).

But sure, first world problems!

Re:European Payments Initiative (EPI) by TMWNN on Friday September 03, 2021 @07:00AM (#28402619)
>I'm not saying it's the end of the world, you're just way behind. I lived in USA, Canada and several European countries so it's first-hand experience, not an exaggeration,

And yet you don't know that, as nraynaud and bayart said, the French use checks (about as often as Americans). Checks are definitely a thing in the UK, too. Are France and the UK no longer part of Europe? (If you make a Brexit joke here, as opposed to actually trying to respond to my point, you automatically lose.)

>Top 3 real frustrations are the difficulty of international wires

I will give you this. When I had to send $2000 to a Canadian earlier this year, the cheapest method we found was to do so through Coinbase using Bitcoin; I think the fee was about 1% (for me to purchase the additional Bitcoins I needed; no fee charged by Coinbase for the transfer itself because it was internal).

>the frequency I have to visit a branch

I've been a customer of USAA Bank for years. As it was created to serve the military (although its remit has expanded), USAA has always been designed to work without a local branch. There are many such branchless banks in the US. That said, I have accounts with other, "traditional" banks and they have been about as online as USAA is for years.

>and how weirdly hard it was in SF to split bills (the last may have changed since 2018).

This is one of the things people use Venmo for.

Re:European Payments Initiative (EPI) by gertrunde on Thursday September 02, 2021 @12:25PM (#28394034)
I think the Venmo comment may have been misunderstood.

The reason that Venmo is seen as an unusual, and somewhat superfluous concept, is that the functionality is just expected to exist as part of every financial app, either legacy/mainstream bank or trendy new fintech upstart - it's really not anything special enough to require a separate system.

Re:European Payments Initiative (EPI) by quantumwannabe on Thursday September 02, 2021 @12:41PM (#28394243)
US banks have their own version of Venmo called Zelle that is integrated into banking apps/websites.
Re:European Payments Initiative (EPI) by mrweasel on Thursday September 02, 2021 @12:04PM (#28393773)
My bank here in Denmark will either issue you a credit card specifically for a US vacation, or strongly recommend that you call to have your existing card invalidate on returning home.
Re:European Payments Initiative (EPI) by ksec on Thursday September 02, 2021 @11:09PM (#28399996)
Wow this is a genius. A specific credit card for specific use in the US so that all transaction there are literally sandboxed.
Re:European Payments Initiative (EPI) by kinnth on Thursday September 02, 2021 @12:36PM (#28394167)
wow, thats hilarious how bad the fraud is then!
Re:European Payments Initiative (EPI) by jonkoops on Thursday September 02, 2021 @02:09PM (#28395367)
We just don't use credit cards, in fact many countries have their own payments systems of varying popularity. The only time I need to reach for a credit card is when interacting with US companies.

IMHO credit cards and the systems around them are a remnant of the past. The US just hasn't caught up with the rest of the world yet.

Re:European Payments Initiative (EPI) by kmlx on Thursday September 02, 2021 @02:29PM (#28395599)
> are a remnant of the past

weird. i'm european, live in europe, only use credit cards. either visa or amex. they offer better protection when buying something, protection against scammers, plus added benefits (from travel to cashback etc). it also contributes to my credit score.

if anything i think europe is actually craving a lot more credit, see klarna as a good example.

Re:European Payments Initiative (EPI) by afiori on Saturday September 04, 2021 @10:01AM (#28415171)
My guess is that many countries in Europe (all 3 I have been in for significant time) have their own internal payment circuit. I two of those debit cards also worked on visa/mastercard, while in 1 (the netherlands) there was a much stronger separation (most stores only accepted the national circuit, bigger stores sometimes had a special register you might have to ask to use)
Re:European Payments Initiative (EPI) by jopsen on Thursday September 02, 2021 @05:49PM (#28397805)
In Denmark we mostly use local debit card, which also duals as VISA debit card when going international.

But using a credit card like MasterCard or VISA in Denmark usually incurs a fee with most merchants.

As for protection, I think you still have months to report fraud. Although you should always report it as soon as discovered.

Re:European Payments Initiative (EPI) by ksec on Friday September 03, 2021 @12:23AM (#28400387)
Well It used to be something like 95% of EUR uses Debit Card ( Visa or Master Debit, it doesn't matter but Debit Card not Credit Card ). And 95% of US were Credit Card.

2008 changes a few things and somehow Debit Card in US caught on. Credit Card in EUR increased as well. I think Debit Card now represent something like 40%+ of transaction in US. Credit Card in EUR is still comparatively small, but much larger than pre 2010s mostly due to company spending.

Re:European Payments Initiative (EPI) by Bayart on Thursday September 02, 2021 @01:40PM (#28395015)
Carding is a non-issue in the EU, at least most places I'm aware of. Between PIN codes that are required everywhere and 2FA that's universal for direct payments on the Internet, there's just not much value there. Accounts with registered payment information are probably worth much more (Paypal).

Losing a card isn't very stressful here.

Re:European Payments Initiative (EPI) by dtech on Thursday September 02, 2021 @11:52AM (#28393623)
credit cards are used minimally in Europe, cash and debit cars are the overwhelming majority of transactions.

There's no difference in fraud protection between debit and credit cards in Europe, at least on my bank. Fraud is refunded following the same rules.

Re:European Payments Initiative (EPI) by dkarp on Thursday September 02, 2021 @11:37AM (#28393397)
Like others say, maybe fraud is less common, but personally I use a credit card 99% of the time.

Most banks will refund fraud in most cases even on a debit card here (UK)

Re:European Payments Initiative (EPI) by systemvoltage on Thursday September 02, 2021 @11:44AM (#28393504)
What’s in it for the bank? How does it recover these costs? Do they charge monthly fee?
Re:European Payments Initiative (EPI) by M2Ys4U on Thursday September 02, 2021 @12:02PM (#28393748)
With chargebacks, the customer's bank will (attempt to) reclaim the money from the vendor's bank.

For credit cards the credit card issuer also shares legal liability with the vendor for purchases over £100.

https://www.ukfinance.org.uk/area-of-expertise/cards/chargeb...

Re:European Payments Initiative (EPI) by dtech on Thursday September 02, 2021 @11:52AM (#28393624)
They usually charge a small monthly fee if you want a credit card. I assume successful fraud is just an operational cost like all the others.
Re:European Payments Initiative (EPI) by etothepii on Thursday September 02, 2021 @12:03PM (#28393757)
In the UK credit cards (as with almost all bank accounts) are usually completely free if you pay the balance in full every month. New accounts frequently come with years of 0% interest on balance transfers. They are also required by law to be jointly and severally liable for the completion of your purchase contracts with the seller if between £100 and £40k.
Re:European Payments Initiative (EPI) by athenot on Thursday September 02, 2021 @11:24AM (#28393196)
In EU, in many cases you can go below zero in your checking account. So there's some buffer in case things go wrong.
Re:European Payments Initiative (EPI) by seppel on Thursday September 02, 2021 @12:04PM (#28393771)
We handle it by making online credit card payments super annoying (you have to login into our bank account and verify it with a second factor), so most people I know stopped using credit card payments.
Re:European Payments Initiative (EPI) by ko27 on Thursday September 02, 2021 @12:17PM (#28393929)
I get a push notification and then use my finger scanner. That's it. Hardly annoying. I think this is a new protocol and all banks will soon migrate to this.